- 16 Aug, 2017 3 commits
-
-
Craig Gallek authored
A recent change to fix up DSA device behavior made the assumption that all skbs passing through the flow disector will be associated with a device. This does not appear to be a safe assumption. Syzkaller found the crash below by attaching a BPF socket filter that tries to find the payload offset of a packet passing between two unix sockets. kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 2940 Comm: syzkaller872007 Not tainted 4.13.0-rc4-next-20170811 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d1b425c0 task.stack: ffff8801d0bc0000 RIP: 0010:__skb_flow_dissect+0xdcd/0x3ae0 net/core/flow_dissector.c:445 RSP: 0018:ffff8801d0bc7340 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000060 RSI: ffffffff856dc080 RDI: 0000000000000300 RBP: ffff8801d0bc7870 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000008 R11: ffffed003a178f1e R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff856dc080 R15: ffff8801ce223140 FS: 00000000016ed880(0000) GS:ffff8801dc000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020008000 CR3: 00000001ce22d000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: skb_flow_dissect_flow_keys include/linux/skbuff.h:1176 [inline] skb_get_poff+0x9a/0x1a0 net/core/flow_dissector.c:1079 ______skb_get_pay_offset net/core/filter.c:114 [inline] __skb_get_pay_offset+0x15/0x20 net/core/filter.c:112 Code: 80 3c 02 00 44 89 6d 10 0f 85 44 2b 00 00 4d 8b 67 20 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 00 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 13 2b 00 00 4d 8b a4 24 00 03 00 00 4d 85 e4 RIP: __skb_flow_dissect+0xdcd/0x3ae0 net/core/flow_dissector.c:445 RSP: ffff8801d0bc7340 Fixes: 43e66528 ("net-next: dsa: fix flow dissection") Reported-by:
Dmitry Vyukov <dvyukov@google.com> Signed-off-by:
Craig Gallek <kraig@google.com> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Signed-off-by:
David S. Miller <davem@davemloft.net>
-
Ido Schimmel authored
I made an embarrassing mistake and used 'IPV6' instead of 'CONFIG_IPV6' around the function that updates the kernel about IPv6 neighbours activity. This can be a problem if the kernel has more neighbours than a certain threshold and it starts deleting those that are supposedly inactive. Fixes: b5f3e0d4 ("mlxsw: spectrum_router: Fix build when IPv6 isn't enabled") Signed-off-by:
Ido Schimmel <idosch@mellanox.com> Signed-off-by:
Jiri Pirko <jiri@mellanox.com> Signed-off-by:
-
Ido Schimmel authored
IPv6 routes currently lack nexthop flags as in IPv4. This has several implications. In the forwarding path, it requires us to check the carrier state of the nexthop device and potentially ignore a linkdown route, instead of checking for RTNH_F_LINKDOWN. It also requires capable drivers to use the user facing IPv6-specific route flags to provide offload indication, instead of using the nexthop flags as in IPv4. Add nexthop flags to IPv6 routes in the 40 bytes hole and use it to provide offload indication instead of the RTF_OFFLOAD flag, which is removed while it's still not part of any official kernel release. In the near future we would like to use the field for the RTNH_F_{LINKDOWN,DEAD} flags, but this change is more involved and might not be ready in time for the current cycle. Signed-off-by:David Ahern <dsahern@gmail.com> Signed-off-by:
-
- 15 Aug, 2017 29 commits
-
-
Zhu Yanjun authored
The driver core clears the driver data to NULL after device_release or on probe failure. Thus, it is not necessary to manually clear the device driver data to NULL. Cc: Joe Jin <joe.jin@oracle.com> Cc: Junxiao Bi <junxiao.bi@oracle.com> Signed-off-by:
Zhu Yanjun <yanjun.zhu@oracle.com> Signed-off-by:
-
Zhu Yanjun authored
The driver core clears the driver data to NULL after device_release or on probe failure. Thus, it is not necessary to manually clear the device driver data to NULL. Cc: Joe Jin <joe.jin@oracle.com> Cc: Junxiao Bi <junxiao.bi@oracle.com> Signed-off-by:
-
Edward Cree authored
State of a register doesn't matter if it wasn't read in reaching an exit; a write screens off all reads downstream of it from all explored_states upstream of it. This allows us to prune many more branches; here are some processed insn counts for some Cilium programs: Program before after bpf_lb_opt_-DLB_L3.o 6515 3361 bpf_lb_opt_-DLB_L4.o 8976 5176 bpf_lb_opt_-DUNKNOWN.o 2960 1137 bpf_lxc_opt_-DDROP_ALL.o 95412 48537 bpf_lxc_opt_-DUNKNOWN.o 141706 78718 bpf_netdev.o 24251 17995 bpf_overlay.o 10999 9385 The runtime is also improved; here are 'time' results in ms: Program before after bpf_lb_opt_-DLB_L3.o 24 6 bpf_lb_opt_-DLB_L4.o 26 11 bpf_lb_opt_-DUNKNOWN.o 11 2 bpf_lxc_opt_-DDROP_ALL.o 1288 139 bpf_lxc_opt_-DUNKNOWN.o 1768 234 bpf_netdev.o 62 31 bpf_overlay.o 15 13 Signed-off-by:
Edward Cree <ecree@solarflare.com> Acked-by:
Daniel Borkmann <daniel@iogearbox.net> Signed-off-by:
-
David S. Miller authored
Julian Wiedmann says: ==================== s390/net: updates for 4.14 a mixed bag of minor fixes, cleanups and refactors for net-next. Please apply. ==================== Signed-off-by: -
Kittipon Meesompop authored
IP-address setting and removal are delayed when the device is not yet in state SOFTSETUP or UP. ref_counter has been implemented only for ip-address with type normal. In this patch ref_counter logic is also used for ip-address with type rxip to allow appropriate handling of multiple postponed rxip add and del calls. Signed-off-by:
Kittipon Meesompop <kmeesomp@linux.vnet.ibm.com> Signed-off-by:
Julian Wiedmann <jwi@linux.vnet.ibm.com> Signed-off-by:
-
Kittipon Meesompop authored
change trace-messages: - from addrxip4 to delrxip4 - from addrxip6 to delrxip6 Signed-off-by:
-
Kittipon Meesompop authored
There exist different commands to add unicast and multicast addresses on the OSA card. rxip addresses are always set as unicast addresses and thus just unicast addresses should be allowed. Adding a multicast address now fails and a grace message is generated. Signed-off-by:
-
Julian Wiedmann authored
Consolidation of duplicated code, no functional change. Signed-off-by:
-
Julian Wiedmann authored
Clean up the inline cruft in s390 net drivers. Many of the inlined functions had only one caller anyway. Suggested-by:
Joe Perches <joe@perches.com> Signed-off-by:
-
Julian Wiedmann authored
Replace some open-coded parts with their proper API calls. Also remove two skb_[re]set_mac_header() calls in the L2 xmit paths that are clearly no longer required, since at least commit 6d1ccff6 ("net: reset mac header in dev_start_xmit()"). Signed-off-by:
Ursula Braun <ubraun@linux.vnet.ibm.com> Signed-off-by:
-
Julian Wiedmann authored
For some xmit paths we pass down a data offset to qeth_fill_buffer(), to indicate that the first k bytes of the skb should be skipped when mapping it into buffer elements. Commit acd9776b ("s390/qeth: no ETH header for outbound AF_IUCV") recently switched the offset for the IUCV-over-HiperSockets path from 0 to ETH_HLEN, and now we have device offset OSA = 0 IQD > 0 for all xmit paths. OSA would previously pass down -1 from do_send_packet(), to distinguish between 1) OSA and 2) IQD with offset 0. That's no longer needed now, so have it pass 0, make the offset unsigned and clean up how we apply the offset in __qeth_fill_buffer(). No change of behaviour for any of our current xmit paths. Signed-off-by:
-
Julian Wiedmann authored
1. for adjusting the buffer's next_element_to_fill in __fill_buffer(), just pass the full qeth_qdio_out_buffer struct 2. when adding a header element, be consistent about passing a hint ('is_first_elem') to __fill_buffer() No functional change. Signed-off-by: -
Julian Wiedmann authored
Improve readability of the code that determines a buffer element's fragment type, and reduce the number of cases down from 5 to 3. Signed-off-by:
-
Julian Wiedmann authored
qeth_l3_setadapter_parms() queries the device for supported adapterparms, even though they already have been queried as part of the device's high-level setup. Remove that extra call. The only call chain for qeth_l3_setadapter_parms() is __qeth_l3_set_online() qeth_core_hardsetup_card() qeth_query_setadapterparms() qeth_l3_setadapter_parms() qeth_query_setadapterparms() , and we only reach qeth_l3_setadapter_parms() if the first adapterparms query succeeds. Hence removing the second query results in no loss of functionality. Signed-off-by:
-
Julian Wiedmann authored
qeth_l2_request_initial_mac() queries the device for its supported adapterparms, even though they already have been queried as part of the device's high-level setup. Remove that extra call. The only call chain for qeth_l2_request_initial_mac() is __qeth_l2_set_online() qeth_core_hardsetup_card() qeth_query_setadapterparms() qeth_l2_setup_netdev() qeth_l2_request_initial_mac() qeth_query_setadapterparms() , and we only reach qeth_l2_request_initial_mac() if the first adapterparms query succeeds. Hence removing the second query results in no loss of functionality. Signed-off-by:
-
Julian Wiedmann authored
After transmitting a skb via send_packet[_fast](), the statistics code accesses the skb once more to account for transmitted page frags. This has a (theoretical?) race against the TX completion - if the TX completion is processed and frees the skb before hard_start_xmit() gets to the statistics part, we access random memory. Fix this by caching the # of page frags, before the skb is transmitted. Signed-off-by:
-
Derek Chickles authored
The fw_type module parameter isn't showing up in the /sys/module/liquidio/parameters directory. Fix it by setting the read permission bits for user, group, other in module_param_string(). Revise the description of fw_type. Initialize the fw_type static char array with the default value to conform to the module parameter description. Signed-off-by:
Derek Chickles <derek.chickles@cavium.com> Signed-off-by:
Felix Manlunas <felix.manlunas@cavium.com> Signed-off-by:
-
David S. Miller authored
Jiri Pirko says: ==================== mlxsw: Add support for nexthop group consolidation for IPv6 Arkadi says: Due to limited ASIC resources the maximum number of routes is limited by the nexthop resource. In order to improve the routing scale nexthop consolidation should be performed. In case of IPv4, the kernel does the consolidation of nexthops in the form of the fib_info struct. In that case, the driver uses the fib_info's address as a key for the internal nexthop group representative struct lookup. In case of IPv6, the kernel doesn't do consolidation, thus the driver should implement it by itself. The hash value is calculated based on the nexthop set, by performing bitwise xor on the ifindexs of the nexthops, in a similar way to IPV4's kernel implementation. In case of collision a full match is performed between the sets which include address and ifindex comparison. In order to use the same hash table in both cases (IPv4/6), the rhashtable is changed to operate on variable length key. ==================== Signed-off-by: -
Arkadi Sharshevsky authored
Due to limited ASIC resources the maximum number of routes is limited by the nexthop resource. In order to improve the routing scale nexthop consolidation should be performed. This patch adds support for IPv6 neighbor consolidation. The hash value is calculated based on the nexthop set, by performing bitwise xor on the ifindexs of the nexthops, in a similar way to IPv4's kernel implementation. In case of collision a full match is performed between the sets which include address and ifindex comparison. Non gateway nexthop groups are not inserted to the hash table due to lack of nexthop device (ifindex). Signed-off-by:
Arkadi Sharshevsky <arkadis@mellanox.com> Reviewed-by:
-
Arkadi Sharshevsky authored
This patch does preparation before introducing IPv6 nexthop group consolidation. Currently the nexthop group hash table is used only by IPv4 and uses fixed key size. In order to support the IPv6's variable length key the current table is changed. Signed-off-by:
-
David S. Miller authored
Intiyaz Basha says: ==================== liquidio: adding support for ethtool --set-ring feature Code reorganization is required for adding ethtool --set-ring feature. First seven patches are for code reorganization. The last patch is for adding this feature. Change Log: V1 -> V2 Only patch #8 was changed: unnecessary parentheses were removed in two if-statements in lio_ethtool_set_ringparam(). ==================== Signed-off-by: -
Intiyaz Basha authored
added support for ethtool --set-ring feature Signed-off-by:
Intiyaz Basha <intiyaz.basha@cavium.com> Signed-off-by:
-
Intiyaz Basha authored
Moving common liquidio_setup_io_queues to lio_core.c Signed-off-by:
-
Intiyaz Basha authored
Moving common liquidio_napi_poll to lio_core.c Signed-off-by:
-
Intiyaz Basha authored
Moving common liquidio_napi_drv_callback to lio_core.c Signed-off-by:
-
Intiyaz Basha authored
Moving common liquidio_push_packet to lio_core.c Signed-off-by:
-
Intiyaz Basha authored
Moving common octeon_setup_droq to lio_core.c Signed-off-by:
-
Intiyaz Basha authored
Moving common update_txq_status to lio_core.c Signed-off-by:
-
Intiyaz Basha authored
Moving common function wait_for_pending_requests to octeon_network.h Signed-off-by:
-
- 14 Aug, 2017 8 commits
-
-
David S. Miller authored
Ohad Oz says: ==================== Enable Mellanox switch device in I2C mode The following patch set updates global to Mellanox Kconfig files to support configuration of Mellanox Switch (mlxsw) without PCI and with I2C only. ==================== Signed-off-by: -
Ohad Oz authored
This patch apply Mellanox network vendor which includes: - Mellanox card devices: ConnectX-4, ConnectX-5 and Connect-IB cards. - Mellanox switch device: SwitchX-2 Switch-IB, Spectrum. Therefore rephrasing help. Signed-off-by:
Ohad Oz <ohado@mellanox.com> Acked-by:
Leon Romanovsky <leonro@mellanox.com> Acked-by:
-
Ohad Oz authored
Mellanox switches (mlxsw) supports I2C systems without PCI, in order to give the ability to the users to use such functionality, there is need to update Kconfig. Signed-off-by:
-
Michal Simek authored
Using tabs instead of space for indentation. Signed-off-by:
Michal Simek <michal.simek@xilinx.com> Reviewed-by:
-
David S. Miller authored
Jiri Pirko says: ==================== mlxsw: spectrum_router: Increase VRF scale Ido says: The purpose of this set is to increase the maximum number of supported VRF devices on top of the Spectrum ASIC under different workloads. This is achieved by sharing the same LPM tree across all the virtual routers for a given L3 protocol (IPv4 / IPv6). The change is explained in detail in the third patch. First two patches are small changes to make review easier. ==================== Signed-off-by: -
Ido Schimmel authored
The number of LPM trees available for lookup is much smaller than the number of virtual routers, which are used to implement VRFs. In addition, an LPM tree can only be used by one protocol - either IPv4 or IPv6. Therefore, in order to increase the number of supported virtual routers to the maximum we need to be able to share LPM trees across virtual routers instead of trying to find an optimized tree for each. Do that by allocating one LPM tree for each protocol, but make sure it will only include prefixes that are actually used, so as to not perform unnecessary lookups. Since changing the structure of a bound tree isn't recommended, whenever a new tree it required, it's first created and then bound to each virtual router, replacing the old one. Signed-off-by:
-
Ido Schimmel authored
Instead of relying on the LPM tree to be assigned to the virtual router before binding the two, lets pass it explicitly. This will later allow us to return upon binding error instead of having to perform a rollback of the assignment. Signed-off-by:
-
Ido Schimmel authored
There is no point in returning a value from function whose return value is never checked. Even if the return value was checked, there wouldn't be anything to do about it, as these functions are either called from error or deletion paths. Signed-off-by:
-
